PRIVACY POLICY

Hello! This privacy policy explains Tapjoy’s privacy practices in connection with information collected about you through your use of Tapjoy Services, including our platform for publisher monetization through advertising and market research campaigns, our dashboard, and our website. (“Tapjoy” means Tapjoy, Inc. and its subsidiaries and affiliates, and may also refer to our advertiser and publisher services, including our dashboard, and our website.)

What is Tapjoy?

Tapjoy, Inc. operates a platform that enables advertisers and market researchers (collectively referred to as “campaign partners”) to reach the users of mobile apps, mobile app users to be compensated for their attention to campaigns, and mobile app publishers to receive revenue based on their users’ interactions with campaigns displayed in their applications.

Tapjoy is a member of the Interactive Advertising Bureau (IAB). More information about the IAB may be found here.

Publishers use Tapjoy by adding our SDK to their apps; this allows us to display ads, ad offers, and market research offers (collectively referred to as “campaign content”) on behalf of our campaign partners, in space within the app.  (“SDK” is short for “software development kit”, meaning software that an app publisher can include in its app to enable Tapjoy services in the app.)

Campaign partners use Tapjoy by placing orders for campaigns using our services to display their campaign content; in turn, publishers and Tapjoy share the money paid by campaign partners for displaying the campaigns in their apps.

Users access campaign content through campaign placements in a participating publisher’s app. These campaigns include an offerwall, which allows a user to choose from a page of various rewarded ad or market research offers (“rewarded” meaning that the user receives a reward in the coins, gems, points, or other in-app virtual currency tokens used in the app they’re using); rewarded video, which offers the user virtual currency reward in exchange for engaging with video campaign content; and interstitial video, which rewards the user with virtual currency or access to premium app content in exchange for a short commercial break.

To further support our publishers, we also offer related optional services, such as analytics, which helps publishers understand how their users use their apps, and virtual currency management services, which helps publishers manage in-app virtual currency.

We provide customer support for users who did not receive an expected in-app reward; this involves working with the campaign partner, the user, and the publisher to identify and resolve the issue.

WHAT INFORMATION DOES TAPJOY COLLECT, AND FOR WHAT PURPOSE?

• That depends on how you interact with Tapjoy. Read on to learn about the following categories:
• If you are an individual who uses a mobile app that uses Tapjoy publisher services, go to the section titled Information collected through our monetization platform
• If you are an individual who submitted a customer support ticket relating to an ad or offer, go to the section titled Customer Support Information
• If you access Tapjoy’s corporate website (www.is.com/tapjoy), or if you use Tapjoy’s dashboard to manage your Tapjoy advertiser, market research, or publisher services, go to the section titled _Website and dashboard user information _
• All users should also review the section titled General privacy practices

INFORMATION COLLECTED THROUGH OUR MONETIZATION PLATFORM

FIRST, WHAT IS NOT COLLECTED?

It may be helpful to know what information is not collected about you or your device: Tapjoy’s monetization platform does not automatically access, collect, or receive your name, your email address, your username, your physical address, your phone number, your credit card or other financial information.

If you opt in to engage with campaign content displayed through the Tapjoy monetization platform, the ad or offer may ask you for personal information. For example, an ad or offer may link to an advertiser’s web site, where the advertiser may ask for your email address to join its mailing list, or your payment information if you are buying its products. A market research survey accessed through the Tapjoy platform may involve questions about your location (e.g., postal code), demographics, or other information. In each case, it is up to you whether to provide the information requested, and any information you choose to provide in these circumstances is considered voluntarily given. You are always free to decline to provide information in connection with a campaign, though doing so may affect whether the campaign partner considers you to have completed the action required to earn the reward.

In connection with customer support, you may provide us with additional information, such as your email address or Twitter handle, and which we use to respond to your request; see Customer support information, below.)

WHAT INFORMATION IS COLLECTED THROUGH TAPJOY’S MONETIZATION PLATFORM?

If you are an individual who uses a mobile app, and the app’s publisher uses Tapjoy monetization services, we, where permitted by applicable law, receive and collect information about your device and the campaign content you access through our services, and we use this information to reward you for campaign engagement, to draw inferences about which campaign content may be more or less interesting to you, and to provide publishers with information about how their apps are used. This information is collected through our SDK, as integrated into the app you use to access campaign content, and through your interactions with campaign content accessed through or on our monetization platform.

Under Tapjoy’s publisher terms of service, app publishers that integrate and use Tapjoy’s monetization services must notify their users of the collection and use of their data in connection with Tapjoy’s monetization services, as described in this policy, and obtain their consent to the extent required by applicable law. To learn about opting out of the use of this information as described in this policy, go to the section titled, How can I opt-out of interest-based advertising?

Here are the types of information that we collect through the Tapjoy monetization platform and services, based on the SDK version current as of the date of this privacy policy. (Please note that not all publishers update their app to reflect each SDK update or version we release; in addition, some parameters are optional or can be changed based on publisher choices in integration.)

Device identifiers (a device identifier is a string of numbers and letters unique to your smartphone or tablet assigned by the manufacturer or platform provider), such as

• Advertising identifier – this is a resettable identifier for advertising use, such as Google Android Advertising ID (GAAID), for Android devices, and ID for Advertisers (IDFA), for iOS devices
• Publishers of Android apps have the option of sending other identifiers, such as Google Android ID or MAC address, for use as a fallback identifier or for analytics use
• The publisher’s user identifier

Information about the device itself, including:

• Whether it is a smartphone or tablet
• What operating system and version it uses (example: iOS, version 11.0)
• Whether the device’s “opt-out” options related to advertising have been enabled
• Model and manufacturer (example: Apple iPhone X, Samsung Galaxy S8)
• Screen size, screen density, and other information relevant to ad formatting and display

Information about the internet connection used to access our services, including

• Mobile carrier
• Network provider
• Whether the network type is wifi or cellular
• IP address
• Timestamp and duration (when the device connected to our services and how long the connection lasted, for a given session)

Information about the app used to access our services and your use of it, and about our SDK, including

• Which version of the app is being used, and which version of our SDK is integrated in the app
• API key (identifier for application)
• How frequently and for how long you use the app, and, at the publisher’s option, information about what level of the game you’re on and your in-app purchases
• If the publisher uses mediation to connect with ad networks, it may opt to send or enable collection of parameters related to mediation services
• Signals relating to eligibility for behavioral advertising

Location-related information – We do not request or receive precise (sometimes referred to as “lat-long”) geolocation data; we infer the perceived general location of the device based on:

• The IP address used to access our services
• Location-related device settings, such as the device’s country code, language setting, and time zone

Information relating to campaign content – We collect information about the campaign content you view, such as:

• What the campaign content is about
• What type of campaign content it is (example: video)
• The reward offered in exchange for your engagement with the campaign content
• Which placement is involved (meaning, where and how the campaign content is displayed in the mobile app where you accessed it)
• Whether you respond to the campaign content’s “call to action” – for example, did you click through to the advertiser’s website? – or complete its requirements (examples: watching a 30-second video; making a purchase)

Market research information – Responses to market research surveys accessed through our platform are voluntary and opt-in. Responses voluntarily provided by you may include

• Demographic information (such as age, household income, gender, highest education completed, household composition)
• General location (such as postal code, or city and state)
• Other information you voluntarily provide, which may include product preferences and opinions, employment status, marital status, veteran status, health information, race or ethnic origin, political opinions, membership information, sexual orientation, religious beliefs – in each case, subject to applicable law.

If at any time you do not wish to respond to a question, please select “Prefer not to say” or equivalent, or exit the survey

Some surveys are conducted by third parties, outside the Tapjoy campaign platform (indicated by a non-Tapjoy URL); in those surveys, your responses go to the market research campaign partner (not to Tapjoy), and will be governed by their privacy policy.

Some surveys are administered partly or entirely within the Tapjoy platform; in those surveys, your responses will be shared with the market research campaign partner who commissioned the survey, and we and the market researcher will associate your responses with the advertising identifier for the device used to access and complete the survey offer, and use it for advertising and market research as described in this privacy policy (see, How does Tapjoy use information collected through the monetization platform)

Information from our campaign partners – The campaign partners using our services may provide us with information they have separately collected about you (for example, whether you already have the app that is being advertised), so that we can improve the relevance of the campaign content we serve to you on their behalf (for example, by not showing you an ad for an app you already have).

HOW DOES TAPJOY USE INFORMATION COLLECTED THROUGH THE MONETIZATION PLATFORM?

We use the information we collect through our monetization platform in the following ways;

• To show you campaign content customized to what our system infers to be your interests, preferences, and locations, based on the information profile associated with your mobile device’s advertising identifier; this is referred to as behavioral or interest-based advertising
• To show you campaign content based upon the context of the app you’re using (instead of based on your inferred interests); this is referred to as contextual advertising
• To determine which campaign content is more or less effective
• For market research purposes
• To target and filter campaign content for publishers and campaign partners – for example, a campaign partner may want to reach a user audience in a specific country, or a publisher may want to exclude some categories of campaign content from its app, or a market researcher may want to target a survey to users in a specific age bracket
• To avoid showing you campaign content for an app or service you already use, or the same campaign content too many times
• To track the rewarded campaign content you engage with, so we can provide you with the rewards you earn
• To respond to and resolve your customer support requests
• In statistical and aggregate form, for analysis and research, to improve our services and to report our services’ results to our advertisers and publishers
• To prevent and detect fraud, and to maintain our services’ and systems’ security

We keep this collected information as long as it remains necessary to provide the Tapjoy Services.

HOW DOES TAPJOY SHARE INFORMATION COLLECTED THROUGH THE MONETIZATION PLATFORM?

The information we collect through our monetization platform is used internally within our platform, and shared only with authorized partners or vendors, as follows:

• We provide publishers using Tapjoy’s analytics service with access to aggregated information about how their users interact with their apps.
• We notify publishers that use Tapjoy’s monetization service and manage their own app currency of when their users earn rewards through our platform, so they can increase these users’ in-app virtual currency balances by the amount of the reward.
• We provide campaign partners that use Tapjoy’s platform to advertise, or their mobile measurement providers, with the advertising device identifiers and IP addresses associated with users who view their campaign content via Tapjoy, so they can track campaign results and identify which users go on to engage with the campaign partner (for example, by buying the advertised product or service or downloading an advertised app), and which ad networks should receive credit for the user’s action.
• We provide campaign partners using Tapjoy’s platform to conduct market research with the advertising device identifiers, IP addresses, and the voluntarily provided demographic information, such as postal code, gender, marital status, education, ethnicity/race, employment-related information, household size, and other responses, associated with those users who voluntarily engage with market research campaign content, so that we or the campaign partners can identify survey opportunities, support and track participation in surveys, disclose survey response data (including voluntarily provided demographic information) to clients for audience measurement services, append demographic data elements to completed surveys and deliver the appended survey data to clients for analytical or research purposes, manage and improve survey quality issues, and track and deliver rewards earned through engaging with market research campaign content.
• Vendors and service providers working for Tapjoy, or for our campaign partners or publishers, have access to information collected via our platform as necessary for them to perform their services for us, or for the campaign partners or publishers they work for. Under our agreements with our service providers, they can use this information only as needed to perform their services; they cannot use it for their own purposes.
• Our corporate family includes international subsidiaries; we provide each other with access to our shared resources as needed to fulfill our shared business responsibilities, including providing and supporting our ad platform. More about Tapjoy ‘s corporate family is here.
• We may share user information, to the extent permissible by applicable laws, when we believe in good faith that such sharing is reasonably necessary to investigate, prevent, or take action regarding possible illegal activities, or to comply with legal process. We may also share user information in situations involving potential threats to the physical safety of any person, violations of this privacy policy or our terms of service; or to respond to the claims of violation of the rights of third parties and/or to protect the rights, property and safety of Tapjoy, our employees, users, or the public and obtaining your consent is difficult. This may involve the sharing of your information with law enforcement, government agencies, courts, and/or other organizations, including for national security and law enforcement purposes.
• Business Transaction. We may share your information with another company if they merge with us or purchase our assets, or as part of due diligence for such a transaction.
• Consent. We may share your information with your consent.
• Aggregated Data. We may aggregate, anonymize and/or de-identify information collected through our ad platform so that the information can no longer be associated with you or your device in specific; our use and disclosure of information that is not identifiable to a specific person or device is not restricted by this Privacy Policy, and it may be used and disclosed to others without limitation.

HOW LONG DOES TAPJOY KEEP INFORMATION COLLECTED THROUGH THE MONETIZATION PLATFORM?

We keep information as long as necessary to provide our services, generally speaking. Information used for interest-based ad targeting is rotated out on a 90-day basis.  Information used to segment audiences for market research surveys, based on the users’ voluntary responses, is rotated out or refreshed every six months. Conversion data and non-production backups of production data are retained for longer due to financial records and disaster recovery requirements.

HOW CAN I OPT OUT OF INTEREST-BASED ADVERTISING?

If you prefer not to receive campaign content tailored to your perceived interests, you can enable device-based “opt-out” options in your device’s settings. If you do so, we will cease processing your personal data for such purposes. We collect these opt-out signals ourselves, and will also respect consent or opt-out flags if passed by the publisher of the app you are using. As of the date of this policy, you can use your device’s native settings to adjust your advertising preferences as follows:

in iOS, visit Settings > Privacy > Advertising > Limit Ad Tracking

in Android, visit Settings > Google > Ads > Opt out of interest-based ads

You can also request an opt-out specific to Tapjoy by going to theData and Privacy Requests page of our website and following the directions we provide you.

Opting out of interest-based advertising does not mean opting out of advertising altogether. There may still be campaign content in the app you use, but it will not be targeted based on your inferred interests. If you are a California resident, please see the “Notice to California Residents” section below for additional information.

CUSTOMER SUPPORT INFORMATION

To submit a request for Tapjoy customer support (for example, for help with a missing Tapjoy ad offer reward), you must submit a working email address; this is required for us to be able to communicate with you about investigating and resolving your support issue. We may request additional pertinent information, such as the device advertising identifier, the ad offer and publisher involved, and so on. Emails and other information submitted for support purposes are used only for support purposes; depending on the circumstances, this may require us to share your information with the campaign partner and publisher whose campaign and app are involved.

WEBSITE AND DASHBOARD USER INFORMATION

TAPJOY DASHBOARD

Our campaign partners and publishers have access to a Tapjoy dashboard. Our dashboard is a business-to-business service that allows Tapjoy’s commercial partners to manage their use of our platform and services and review their results. When you create a dashboard account, you provide information such as your name, the name of your company, your username and password, your email address, postal address, phone number, and payment information, as well as any required financial information (e.g., tax ID, VAT, or sales tax registration number). We use Stripe to process campaign partner credit card payments. We use this information to provide our commercial partners with Tapjoy services and support. If you invite other users to your Tapjoy dashboard account, we will collect the email address of the employee or other individual you wish to add and use it to send them a one-time email informing them they have been added. If they are not your employee, you must have their consent before providing us with their email address to invite them to join your dashboard account.

TAPJOY WEBSITE AND SOCIAL MEDIA

Our corporate website, www.tapjoy.com, provides general information about Tapjoy and our products and services; we also maintain a blog and various social media channels. If you post information through one of these channels, you understand that we cannot control what other users do with any content (including without limitation images, ratings, captions, and comments) you voluntarily post. You should not post any sensitive personal data, such as details of your ethnicity, health or political preferences or photos of yourself to any Tapjoy board, blog, social media channel, or forum, nor should you allow other users to have access to your content if you do not wish them to make your content publicly available to be collected and used by others, or to be redistributed through the Internet and other media channels.

AGGREGATED DATA

We may aggregate, anonymize and/or de-identify information collected through our website, dashboard, and social media channels so that the information no longer relates to you individually. As a result, our use and disclosure of aggregated and/or de-identified information is not restricted by this Privacy Policy, and it may be used and disclosed to others without limitation.

COOKIES AND RELATED TRACKING TECHNOLOGIES

When you use our website and dashboard, we may place and read cookies or access information on your device to obtain information about the performance of our site, enable you to move around the site, to record your preferences and to serve you with advertising that is relevant to your interests. This information may, where permitted by applicable law, then be combined with other information we hold about you. Information and technologies we may use include:

• Device and usage information. When you interact with our website or dashboard, we may collect information such as (a) IP addresses, unique device identifiers, and other information about your device(s), browser types, browser language, operating system, the state or country from which you accessed the services; and (b) information related to the ways in which you interact with our website, such as: referring and exit pages and URLs, platform type, the number of clicks, internal Tapjoy subdomain names, landing pages, pages viewed and the order of those pages, the amount of time spent on particular pages, the date and time you used the services, error logs, and other similar information. As described in Online Analytics below, we may use third party analytics providers and technologies, including cookies and similar tools, to assist us in understanding how the Tapjoy Web Services are used.
• Location information. We may market to you based on your location, inferred from the IP address you use to reach our website or dashboard.
• Cookies and other technologies. When you use the Tapjoy website or dashboard, we use persistent and session cookies and other similar technologies to perform various tasks, such as: (a) storing your dashboard account username and password; (b) analyzing the usage of our website and dashboard; and (c) customizing our website and dashboard to your preferences. You can find more information about cookies and how to manage them at http://www.allaboutcookies.org/. Most browsers automatically accept cookies, but you can modify your browser settings to decline cookies by visiting your browser’s help page. If you choose to decline cookies, please note that you may not be able to sign in, customize, or use some features of the Tapjoy Web Services. By using our website and dashboard with your browser set to accept cookies, you consent to our use of cookies in the manner described above. In addition to cookies, we may use a technology called clear gifs (a.k.a. web beacons) that help us better manage and analyze content. Clear gifs are tiny graphics with a unique identifier, similar in function to cookies, and are used to track the online movements of web users. In contrast to cookies, which are stored on a user’s computer hard drive, clear gifs are embedded invisibly on web pages. Where permissible under applicable law, we may include web beacons in e-mail messages or newsletters to determine whether the message has been opened and for other analytics purposes.

ONLINE ANALYTICS

To help understand your use of our website and dashboard, we use third-party web analytics providers, such as Google Analytics, which in turn use the technology described above at Cookies and related tracking technologies. Our service providers collect and use this information to evaluate how websites are used. To opt out of tracking via Google Analytics, you may install the Google Analytics Opt-Out Browser Add-on.

HOW TAPJOY USES INFORMATION COLLECTED THROUGH OUR WEBSITE AND DASHBOARD

We use the information we collect through your use of our corporate website and our dashboard to provide our services, to manage your publisher or campaign partner account, to do business with you as a publisher or campaign partner (including taking orders, reporting results, and so on), to communicate with you (including responding to your inquiries, informing you about products and services based on your marketing preferences, and notifying you of new features), to analyze the user bases and usage patterns for our website and dashboard, and to provide and improve our services. We also use this information to improve our corporate website content and to personalize the dashboard for you. We keep the information we collect for so long as we continue to provide our website, dashboard, and services.

HOW DOES TAPJOY SHARE INFORMATION COLLECTED THROUGH THE WEBSITE AND DASHBOARD?

We don’t buy, sell, or trade-in information collected through our website and dashboard. We share only as described here:

• Vendors and service providers working for Tapjoy, or for our campaign partners or publishers, have access to information collected via our ad platform as necessary for them to perform their services we engaged them to do. Unless we tell you otherwise, under our agreements with our service providers, they can use this information only as needed to perform their services; they cannot use it for their own purposes. These service providers include analytics providers, payment processors, product fulfillment providers, providers of technical infrastructure, technical support, email providers, and customer support vendors.
• Our corporate family includes international subsidiaries; we provide each other with access to our shared resources as needed to fulfill our shared business responsibilities, including providing and supporting our ad platform. More about Tapjoy ‘s corporate family is here.
• We may share your information, to the extent permissible by applicable laws, when we believe in good faith that such sharing is reasonably necessary to investigate, prevent, or take action regarding possible illegal activities, or to comply with legal process. We may also share your information in situations involving potential threats to the physical safety of any person, violations of this privacy policy or our terms of service; or to respond to the claims of violation of the rights of third parties and/or to protect the rights, property and safety of Tapjoy, our employees, users, or the public and obtaining your consent is difficult. This may involve the sharing of your information with law enforcement, government agencies, courts, and/or other organizations, including for national security and law enforcement purposes.
• We may share your information in connection with any merger, reorganization, a sale of some or all Tapjoy assets, or a financing or acquisition of all or a portion of our business by another company (including in the course of due diligence for any such transaction).
• We may share your information with your consent.

WHAT CHOICES DO I HAVE ABOUT USE OF INFORMATION RELATED TO TAPJOY’S WEBSITE OR DASHBOARD?

• Commercial Marketing. We will comply with applicable marketing laws; for example, where applicable law requires prior consent, Tapjoy will only send you marketing email if you have opted in. To opt out of receiving marketing emails or other commercial communications from us, use the “unsubscribe” option in a commercial email from us or send us an email at privacy@tapjoy.com. It may take several days for us to process your request, consistent with applicable law.
• Publisher and Campaign Partner Accounts. If you have access to a publisher or campaign partner dashboard account and do not want your email address used, please contact your account manager or contact us at privacy@tapjoy.com.
• Dashboard Account Deactivation. To request deactivation of your dashboard account, email your account manager or contact us at privacy@tapjoy.com. Some information may remain in our records after deactivation of your account based on business needs. After deactivation, we may continue to use any information constituting financial records, as well as aggregated data derived from or incorporating your personal information but not identifying you personally.

TAPJOY APPS

We no longer collect information from or about users of our legacy apps (TapDefense, TapOut, Coloroid, TapColors, Void Walker) and legacy app-discovery and currency-management services (MyTapjoy). We are no longer maintaining, updating, or supporting these apps and services; continued use is at the sole option and risk of the user.

GENERAL PRIVACY PRACTICES

HOW DOES TAPJOY SECURE PERSONAL INFORMATION?

Tapjoy processes personal information only as relevant or necessary to provide our services. We use physical, technical, and administrative procedures designed to safeguard your information and data security, and to prevent unauthorized access. These safeguards take into account the sensitivity of the information that we collect, process, and store and the current state of technology. Although we take such measures to safeguard against unauthorized access of information, the Internet and the services are not 100% secure so we cannot assure you that all information we collect or store will be protected at all times from all unauthorized access.

INTERNATIONAL USERS

If you are located outside the United States and choose to use our services or provide information to us, your information is provided to Tapjoy in the United States, and may be and processed and stored in the United States and otherwise outside of your country of residence, by Tapjoy and by third parties with which we share information in accordance with this privacy policy.

CHILD AND YOUTH USERS

If you are under the locally applicable minimum age of consent to data use, please do not sign up as a Tapjoy campaign partner or publisher, engage with any offer-based campaign content, or send us any information about yourself. (In the US, your minimum age is 13; in the EEA and Switzerland, it is age 16 unless your country has adopted a lower age; and in California, it is age 16 subject to certain exceptions.) Publishers who target their apps toward audiences that include young users, in part or in full, may choose to offer users below the minimum age the ability to access advertising content through our platform and services; as a condition for doing so, the publisher is required to flag the users’ devices and associated data for exclusion from behavioral targeting, and contextual advertising is provided instead. Users below the minimum age are not otherwise eligible to interact with Tapjoy services. Please inform us by emailing privacy@tapjoy.com if you learn that we have been provided with personal information from a child under the applicable minimum age without exclusion flagging or verified parental consent, so that we may take appropriate steps to delete that personal information.

CHANGES TO OUR PRIVACY POLICY

We reserve the right to update (amend) this Privacy Policy from time to time to reflect changes in the law, our data collection and use practices, the features of our platform and services, or advances in technology. Please check this page periodically for changes and review them carefully, as our use of information at a given point is governed by the Privacy Policy that is then in effect. Your continued use of our services after a Privacy Policy update means that you understand and acknowledge the applicability of the updated policy.

THIRD-PARTY SITES AND SERVICES

Our services and communications may contain links to third-party websites, including social media services. Your use of these links, websites, or services may result in the collection, processing or sharing of information about you, depending on what you use. We are not responsible for the content or privacy practices of other websites or services that may be linked on our services. We do not endorse or make any representations about third-party websites or services. Any information you choose to provide to these services, or that they collect, is covered by their privacy policy rather than ours, so please make sure to read it.

FEEDBACK ABOUT TAPJOY

If you submit feedback or suggestions about our services, we may use your feedback or suggestions without obligation to you.

NOTICE TO CALIFORNIA USERS

These additional disclosures for California residents apply only to individuals who reside in California. The California Consumer Privacy Act of 2018 (“CCPA”) provides additional rights to know, delete and opt out, and requires businesses collecting or disclosing personal information to provide notices and means to exercise those rights. The words used in this section have the meanings given to them in the CCPA, which may be broader than their common meaning. For example, the definition of “personal information” under the CCPA includes your name, but also more general information like age. Tapjoy will facilitate the request of any eligible verified user.

NOTICE OF COLLECTION

We do not sell information as the term “sell” is traditionally understood, except to the extent the transfer of voluntarily provided information for market research purposes is considered a “sale”. We receive information from publishers  about their users’ devices, as described above in Information collected via our monetization platform, and we use this information (where permitted) for interest-based advertising through our platform, as described above at How does Tapjoy use information collected via the monetization platform?, and share it as described above at** How does Tapjoy share information collected via the monetization platform?**. If and to the extent “sale” under the CCPA is interpreted to include advertising technology activities such as those implemented specifically for interest-based advertising, we will comply with applicable law.

As described above at, What information is collected through Tapjoy’s monetization platform? and Website and dashboard user information, Tapjoy discloses personal information to third parties for commercial purposes, including your mobile device advertising identifier and IP address with campaign partners whose campaign content you access, for tracking purposes, and with the publisher of your app, for delivery of rewards earned by you; if you opt in to respond to a market researcher’s survey, Tapjoy shares your survey responses, device advertising identifier, and IP address with the market researcher, who may share the information with its client. Tapjoy uses the information collected through our monetization platform to infer your interests and target campaign content displayed to you based on those inferred interests. Market research campaigns may include questions intended to help Tapjoy or our market research campaign partners or their clients identify audience segments to target based on criteria set by the market researcher or its clients. We partner with service providers and vendors to assist with our daily operations and manage our Service. Please review, “How does Tapjoy share information collected through the monetzation platform?” and “How does Tapjoy share information collected through the website and dashboard?”, above, for more detail.

RIGHT TO KNOW AND DELETE

California residents have the right to delete the personal information we have collected about them, and the right to know certain information about our data practices in the preceding twelve (12) months. In particular, you have the right to request the following from us:

The categories of personal information we have collected about you;

The categories of sources from which the personal information was collected;

The categories of personal information about you we disclosed for a business purpose or sold;

The categories of third parties to whom the personal information was disclosed for a business purpose or sold;

The business or commercial purpose for collecting or selling the personal information; and

The specific pieces of personal information we have collected about you.

You may exercise any of these rights by submitting a request through the Data and Privacy Requests section of our website, or by emailing ccpa@tapjoy.com. In the request, please specify which right you are seeking to exercise and the scope of the request. We will promptly confirm receipt of your request (within 10 days or sooner). We may require specific information from you to help us verify your identity and process your request. We do not want to disclose data to unauthorized recipients, so if we are unable to verify your identity or authenticate your ownership or authority over the device involved, we will deny your requests to know or delete. Tapjoy will facilitate all requests of a verified eligible user.

RIGHT TO OPT-OUT

We use personal information to provide our publisher monetization services. We do not believe that this use means that we sell your personal information, as the term “sell” is defined under the California Consumer Privacy Act. Nonetheless, you have the ability to opt-out of the use of your personal information for behavioral advertising at any time, and if and to the extent we sell your personal information as the term “sell” is defined under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information by us to third parties at any time. Please review the section above titled, How can I opt-out of interest-based advertising?.

METRICS

The following metrics include worldwide access and opt-out requests submitted by consumers under both GDPR and CCPA.

Date	Status	Access Request	Opt-Out Request	Total
CY2021	Unverifiable Requests	471	485	956
	**Resolved Verifiable Requests **	157	518	675
	Denied Verifiable Requests	0	0	0

**Mean Number of Days for Response **	Access Request	Opt-Out Request	All Requests
	4.35 days	2.54 days	2.92 days

AUTHORIZED AGENT

You can designate an authorized agent to submit requests on your behalf. However, we will require written proof of the agent’s permission to do so and verify your identity directly.

RIGHT TO NON-DISCRIMINATION

You have the right not to receive discriminatory treatment by us for the exercise of any your rights.

FINANCIAL INCENTIVES

Financial incentives are programs, benefits, or other offerings, including payments to consumers as compensation, for the disclosure, deletion, or sale of personal information about them.

As described above, app publishers use Tapjoy to monetize their apps, through displaying campaign content to users in the apps, provided by third-party campaign partners. Campaign partners use Tapjoy to access app users for their campaigns, and reward the users (in the form of in-game currency or tokens in the publisher’s app, or access to additional or premium app content) for their engagement with campaign content. Tapjoy is the platform supporting and enabling these interactions between users, publishers, and campaign partners. These interactions may involve in-app currency rewards or other benefits to users, which may or may not qualify as financial incentives, but any such rewards or benefits are offered by or on behalf of campaign partners and publishers, not by Tapjoy.  In any case, your voluntary use of the Tapjoy platform, by engaging with campaign content to access in-app rewards, regardless of form, will be interpreted as affirmative consent to the terms of such incentive.

SHINE THE LIGHT

California law permits users who are California residents to request and obtain from us once a year, free of charge, a list of the third parties to whom we have disclosed their personal information (if any) for their direct marketing purposes in the prior calendar year, as well as the type of personal information disclosed to those parties. As explained above, we do not share your personal information with third parties for use for their own direct marketing purposes.

ACCESSING AND DELETING YOUR INFORMATION.

You may, under applicable European law, have the right to access, correct, update or delete personal information Tapjoy holds about you.  Please see Exercising your rights as an app user below for more information about those rights.

If you have a Tapjoy publisher or advertiser dashboard account, you may use your account settings to access and update your account information. You may also submit a request to access or delete the personal information we have about you through the Data and Privacy Requests section of our website. In some cases, we may not be able to remove your personal information (e.g., for legal reasons), in which case we will let you know if we are unable to do so and why.

THE EU GDPR

The EU General Data Protection Regulation (“GDPR”), effective May 25, 2018 in the EEA countries and Switzerland, requires Tapjoy and the publishers and advertisers using our services to provide app users with information about the processing of personal data. (“Personal data”, as used in the GDPR, means information relating to an identified or identifiable natural person, including name, address, cookie identifiers, mobile device identifiers, and more; “app user” here means the person involved; and “processing” of data includes collection, storage, and use.)

This section provides representations and information in compliance with our GDPR obligations, for the benefit of our users located in the EEA countries and Switzerland only.

LEGAL GROUNDS FOR PROCESSING YOUR PERSONAL DATA

The GDPR requires us to identify the legal ground we’re relying on to process personal data about you.  Our legal grounds for processing your personal data as described in this Privacy Policy will typically be because:

• You provided your consent. To store and access information on your device, we rely on your consent.  For this “cookie consent” (which applies not only to “cookies” but also to mobile device advertising identifiers), to fulfill our obligations under the ePrivacy Directive, we rely on the mobile app publishers that use our services and oblige them contractually to pass on only legally obtained data. In some circumstances, we may obtain your consent directly, in which case we will adhere to applicable laws relating to consent and its withdrawal.
• The processing is in our legitimate interest. In some cases, we use legitimate interest as a legal basis for processing personal data to provide our and our commercial partners’ services. A legitimate interest we rely on, for instance, is the tailoring of campaign content and opportunities to obtain in-game rewards to users of mobile applications; this benefits users through a value exchange that goes beyond the original collection of mobile device advertising identifiers. Our legitimate interest also includes providing analysis of and reporting about ad campaigns. We also rely on legitimate interest when we use personal data to maintain the security of our services, including fraud detection and identifying and fixing bugs.
• Contractual Relationships. Sometimes, we process personal data as necessary under a contractual relationship we have, such as our customer records and contact information.
• Legal Obligations. Finally, some processing of data may be necessary for us to comply with our legal or regulatory obligations.

TRANSFERS OF PERSONAL DATA

We are based in the United States with offices around the world, and work with other global companies and technologies. As a result, we may need to transfer your personal data outside of its country of origin. For instance, we may transfer your personal data to commercial partners or service providers located in jurisdictions outside the EEA and Switzerland, which have data protection laws less strict than those in Europe.

When Tapjoy receives personal data that is transferred from the EEA or Switzerland to Tapjoy in the US, we take steps to make sure that appropriate safeguards are in place to protect it; we use European standard contractual clauses, data processing agreements where required by European Data Protection Law, and EU-U.S. and Swiss-U.S. Privacy Shield Frameworks. Our Privacy Shield certification is available at https://www.privacyshield.gov/list. We comply with Privacy Shield Principles for all transfers from the EU, EEA, and Switzerland, including the onward transfer liability provisions. When Tapjoy receives information under the Privacy Shield and then transfers it to a third-party service provider acting as an agent on our behalf, Tapjoy has certain liability under the Privacy Shield if both (i) the agent processes the information in a manner inconsistent with the Privacy Shield and (ii) Tapjoy is responsible for the event giving rise to the damage. Contact us at privacy@tapjoy.com for more information about the safeguards we use to protect your personal data and privacy rights.

PERSONAL DATA RETENTION

As a general matter, we retain your personal data for as long as necessary to provide our services, or for other important purposes such as complying with legal obligations, resolving disputes, and enforcing our agreements. We generally rotate through personal data used for ad personalization on a 90-day timetable and personal data used for market research audience segmentation and targeting on a 180-day timetable, provided that we may retain data if we have a legal or significant operational need to do so, such as for auditing, corporate record-keeping, compliance, accounting or bug-fixes.

If you are a Tapjoy campaign partner or publisher, we retain your information as long as your account is active and for as long as necessary for legal or operational purposes, such as auditing, corporate record-keeping, compliance, or accounting, after its closure.

EXERCISING YOUR RIGHTS

As an individual covered by the GDPR, you have certain rights about the personal data that data controllers hold about you, including right of access, right to request correction, right to be forgotten (i.e., deletion), and right to object to processing (including profiling for online ad targeting).

RIGHT TO ACCESS

If you are a consumer and wish to exercise your right to access personal data we process as a data controller, you may do so through theData and Privacy Requests page of our website. We will assess requests to exercise data access rights on a case-by-case basis, factoring in the difficulty of verifying whether a mobile device advertising identifier, and the data we have linked to it, truly and solely belongs to the person making the request, as well as the potential risk of harm through disclosure of personal data to the wrong individual. Because improper disclosure would likely harm the privacy rights and freedoms of the person involved, we may limit the personal data we make available. We only grant requests where we are the data controller, as explained further, below. Where we act as a processor for one of our campaign partners or publishers, we will refer your request to that company; if your request involves a third party, such as an advertiser, market researcher, or publisher, please contact them directly.

If you have a Tapjoy publisher or campaign partner dashboard account, you may use your account settings to access and update or delete account information. You may also request access through theData and Privacy Requests page of our website.

RIGHT TO CORRECT

If you wish to exercise your right to correct Personal Data, you may do so by contacting us at the contact information below.

RIGHT TO OBJECT TO PROCESSING OR TO WITHDRAW CONSENT

By enabling device-based “opt-out” options in your device’s settings, you may withdraw consent for processing where we rely on consent. If you do so, we will cease processing your personal data for such purposes within 30 days. We collect these opt-out signals ourselves, and will also respect consent or opt-out flags if passed by the publisher of the app you are using. For instructions and more detail, please see above at, How can I opt out of interest-based advertising?  Please note that opting out does not mean opting out of advertising or campaign content altogether; there may still be campaign content in the app, but it will not be targeted based on your inferred interests.

RIGHT TO ERASURE

You also have the right to request erasure of personal data that we hold as a controller. The above opt-out process satisfies this right, because when a user opts-out (whether through device settings or by submitting a request to gdpr-optout@tapjoy.com and following our instructions), we stop using your personal data to provide our services to you; the data is permanently rendered disconnected to your device and will be automatically deleted from our production system. We may retain copies of some personal data for our own internal and necessary purposes, such as auditing, accounting and billing, legal, bug-detection, backups, and (if applicable) to ensure that you receive and that we are able to track the rewards you have received.

RIGHT TO LODGE COMPLAINTS.

We encourage you to contact us at the contact information below should you have a Privacy Shield-related (or general privacy-related) complaint. If you are a resident of the European Union and are dissatisfied with the manner in which we have addressed your concerns about our privacy practices, you may seek further assistance, at no cost to you, from our designated Privacy Shield independent recourse mechanism, JAMS, on their website at https://www.jamsadr.com/eu-us-privacy-shield. As further explained in the Privacy Shield Principles, a binding arbitration option will also be made available to you in order to address residual complaints not resolved by any other means. Prior to initiating such arbitration, you must: (1) contact us and afford us the opportunity to resolve the issue; (2) seek assistance from our designated independent recourse mechanism; and (3) contact the U.S. Department of Commerce (either directly or through a European Data Protection Authority) and afford the Department of Commerce time to attempt to resolve the issue. Each party shall be responsible for its own attorney’s fees. Please be advised that, pursuant to the Privacy Shield, the arbitrator(s) may only impose individual-specific, non-monetary, equitable relief necessary to remedy any violation of the Privacy Shield Principles with respect to the individual. Tapjoy is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC).

TAPJOY: A DATA CONTROLLER AND A DATA PROCESSOR

EU data protection law makes a distinction between organizations that process personal data for their own purposes (known as “data controllers”) and organizations that process personal data on behalf of other organizations (known as “data processors”).  If you have a question or complaint about how your personal data is handled, we encourage you to direct your inquiry to the relevant data controller, since data controllers have primary responsibility for your personal data.

Tapjoy may act as either a data controller or a data processor in handling your personal data, depending on the precise circumstances. For instance, for personal data that we use internally to create our data-related services, such as interest-based ad targeting, and for personal data that we collect about our publisher and advertiser customers for use in marketing to them, we are a data controller. But when we handle personal data strictly on behalf of our customers to provide our services to them (for example, if they provide us with a list of device identifiers to use for targeting or suppression), we are a data processor. If you have questions about data that is used primarily on behalf of one of our publishers or advertisers, you should contact them.

QUESTIONS OR CONCERNS

To opt-out of Tapjoy services or access your personal information, go to theData and Privacy Requests page of our website and follow the provided instructions. (California residents only: you may also email us at ccpa @tapjoy.com and follow the provided instructions.)

If you have any questions or concerns regarding our privacy policies, please send us a message to privacy@tapjoy.com, or mail us at Tapjoy, Inc., 353 Sacramento Street, 6th Floor, San Francisco, CA 94111, U.S., Attn: Privacy, or call us at +1 415-766-6900.

Our representative in the EU may be reached by writing to Tapjoy Limited, International Buildings, 5th floor, 71 Kingsway, London WC2B 6ST, UK.

Please note, these communication channels do not support customer support matters. Please visit https://www.tapjoy.com/customer-support/ to access our customer support center for help with customer support questions or concerns.

Effective Date: January 1, 2020